Repository navigation
Add Array support to 'User Session Note' mappers. - #45939
Open
artur-baltabayev wants to merge 1 commit into
Open
artur-baltabayev wants to merge 1 commit into
artur-baltabayev wants to merge 1 commit into
Conversation
artur-baltabayev
force-pushed
the
array-support-for-user-session-note-mappers
branch
from
February 9, 2026 14:31
e43725b to
5616226
Compare
artur-baltabayev
force-pushed
the
array-support-for-user-session-note-mappers
branch
2 times, most recently
from
April 2, 2026 12:09
69bccb7 to
a7e1f82
Compare
artur-baltabayev
force-pushed
the
array-support-for-user-session-note-mappers
branch
3 times, most recently
from
April 21, 2026 13:04
7bf159e to
a3e1277
Compare
Closes keycloak#45938 Signed-off-by: bal1imb <Artur.Baltabayev@bosch.com>
stianst
force-pushed
the
array-support-for-user-session-note-mappers
branch
from
May 29, 2026 07:25
a3e1277 to
c5d6efd
Compare
Contributor
|
@pedroigor Can you please have a look at this one? |
Contributor
There was a problem hiding this comment.
Pull request overview
Adds first-class “Array” handling for the OIDC “User Session Note” mappers, enabling array-valued claims (e.g., AMR) to round-trip between incoming brokered tokens and outgoing Keycloak-issued tokens.
Changes:
- Introduces
"Array"as a supportedjsonType.labelinOIDCAttributeMapperHelper, including conversion from comma-separated String toList. - Updates
ClaimToUserSessionNoteMapperto accept non-String claim values and map them into a session note representation. - Extends
OidcClaimToUserSessionNoteMapperTestwith an end-to-end assertion for producing an array-valued token claim from a session note.
Reviewed changes
Copilot reviewed 3 out of 3 changed files in this pull request and generated 5 comments.
| File | Description |
|---|---|
| testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/broker/OidcClaimToUserSessionNoteMapperTest.java | Adds an array-focused broker test and helper for updating the consumer-side session-note-to-claim mapper config. |
| services/src/main/java/org/keycloak/protocol/oidc/mappers/OIDCAttributeMapperHelper.java | Adds "Array" as a supported JSON type and implements conversion behavior. |
| services/src/main/java/org/keycloak/broker/oidc/mappers/ClaimToUserSessionNoteMapper.java | Adds List/Array claim support when mapping incoming IdP claims into user session notes. |
Comment on lines
121
to
+125
| for (String value : claim.getValue()) { | ||
| if (claimValueObj != null) { | ||
| if (!(claimValueObj instanceof String)) { | ||
| LOG.warnf( | ||
| "Claim '%s' does not contain a string value for user with brokerUserId '%s'. " | ||
| + "Actual value is of type '%s': %s", | ||
| claim.getKey(), | ||
| context.getBrokerUserId(), claimValueObj.getClass(), claimValueObj); | ||
| continue; | ||
| } | ||
|
|
||
| String claimValue = (String) claimValueObj; | ||
|
|
||
| boolean claimValuesMatch = areClaimValuesRegex ? valueMatchesRegex(value, claimValue) | ||
| : valueEquals(value, claimValue); | ||
|
|
||
| if (claimValuesMatch) { | ||
| context.setSessionNote(claim.getKey(), claimValue); | ||
| } | ||
| final var claimValue = getClaimValueString(brokeredUserId, claimKey, claimValueObj); | ||
| if (claimValue == null) { | ||
| continue; | ||
| } |
Comment on lines
+155
to
+168
| private String convertArrayClaimToString(final String brokeredUserId, final String claimKey, | ||
| final Object claimValueObj) { | ||
| var result = String.valueOf(claimValueObj); | ||
| result = result.replace(" ", ""); | ||
| result = result.replace("[", ""); | ||
| result = result.replace("]", ""); | ||
|
|
||
| final var resultIsInvalid = containsMalformedEntries(brokeredUserId, claimKey, claimValueObj, result); | ||
| if (Boolean.TRUE.equals(resultIsInvalid)) { | ||
| return null; | ||
| } | ||
|
|
||
| return result; | ||
| } |
Comment on lines
+234
to
+238
| final var existingConfig = mapper.getConfig(); | ||
| Map<String, String> newConfig = existingConfig == null ? new HashMap<>() : existingConfig; | ||
| newConfig.put("jsonType.label", claimJsonType); | ||
|
|
||
| clientProtocolMappersResource.update(mapper.getId(), mapper); |
Comment on lines
+225
to
+231
| case "Array": | ||
| if (attributeValue instanceof List) return attributeValue; | ||
| if (attributeValue instanceof String attributeValueString) { | ||
| final var entries = attributeValueString.split(","); | ||
| return List.of(entries); | ||
| } | ||
| return List.of(attributeValue); |
Comment on lines
+131
to
+136
| public void claimWithArrayValueIsMappedAsExpected() { | ||
| updateSessionNoteToClaimMapper(ARRAY_CLAIM_JSON_TYPE); | ||
| createUserSessionNoteIdpMapper(IdentityProviderMapperSyncMode.FORCE, "foo-1,foo-2"); | ||
|
|
||
| final var updatedClaimValue = "foo-1,foo-2"; | ||
| updateProviderHardcodedClaimMapper(updatedClaimValue); |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Closes #45938